[Android Software/Hacking General [Developers Only]] sbpetrack:
Flip a bit=>unlock bootloader. A few readbacks requested

I am quite new to Android & I seem to have an unusual situation. I've been able to make some progress but hit a wall. I think I have a way forward, but it's sufficiently weird that I'd appreciate your feedback on what i propose -- is there even a chance it will work? And if so, I'm hoping that someone will help me by providing 4 quick read-backs that I need and can't do myself. OK, here's the deal:

My phone is an EE Rook, which is in fact a ZTE Blade A410, branded by the UK carrier EE. It is a Mediatek MT6735M device.

I ran into a strange problem trying to unlock the bootloader: I can toggle "OEM unlocking" and USB debugging in Dev. Options, and then entering the usual commands "adb reboot bootloader" and "fastboot oem unlock" brings up the confirmation screen on the phone.... the one where I'm supposed to press Vol+ to select "yes" to confirm that i want to unlock the bootloader and then Power to wipe and reboot. What happens as a result is.... NOTHING. it's as if the volume up button is just disabled. If I press Volume Down, I do return to fastboot. So I can cancel but not confirm unlocking the bootloader. The fact is that I'm still bootloader locked. The command "fastboot getvar secure getvar unlocked" show that I'm still S-on and locked is "true".

On the other hand, from some combination of online information, MTK Droid Tools, SP Flash Tool, the output of cat /proc/emmc, etc... -- I **have** succeeded in getting root. Basically, I carefully cobbled together a scatter file which I'm quite sure is correct. I used that and SP Flash Tool to download TWRP to the recovery, and then flashed a Superuser apk to root the phone. Done.

But I would truly like to have the bootloader unlocked as well. So here's my crazy idea:

In several other forums here, it is noted that in fact the difference between a locked and an unlocked bootloader is one single byte of ROM --- obviously

that's the place where the value of the bootloader variable "unlocked" is stored. (I believe that this implies that the values of the two variables "unlocked" and "secure" must be encoded by a single byte: "unlocked" being false is equivalent to "secure" being true). Even if the location of this byte is not constant from one device to another, there's every reason to think that for our devices as well, the difference will be a single byte. The only question is where is that byte?

So my question/request is just this: Could someone who has a MT6735M-based phone and a nandroid backup be so truly kind as to do the following:

1. take a read-back of the entire system part of rom (i.e. everything but the user data and cache partitions)

2. take a read-back of the nvram partition (I understand that this is where the bootloader variables are stored).

The go an relock the bootloader and repeat.

(You can then restore your nandroid).

With luck, we'll see that between the bootloader locked and unlocked is a single byte, and you'll tell me where in nvram this byte is located. I'll flash this one-byte change, and get the unlocked bootloader I seek. Not to mention the extra advantage that I'll get my unlocked bootloader without having to wipe my device.

Scott